---
id: "CVE-2026-119289"
kind: "vulnerability"
aliases: ["CVE-2026-119289"]
title: "Zuke: workflow gate can adopt a forged GitHub run and release"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["deno", "github-actions", "package", "zuke"]
not_affected_if: ["dispatch-limited-to-trusted-users", "no-githubworkflow-gate"]
published_at: "2026-10-30T16:17:43+00:00"
first_seen_at: "2026-10-30T16:31:25+00:00"
updated_at: "2026-10-30T16:32:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119289", "first_seen_at": "2026-10-30T16:31:25+00:00"}]
---

# Zuke: workflow gate can adopt a forged GitHub run and release

Zuke is a Deno build automation library whose @zuke/gh githubWorkflow gate matches a dispatched workflow run only by a display-title marker that anyone with dispatch permission can copy. An attacker who holds workflow_dispatch rights on the external workflow repository can have the gate accept their run's result, so an unvalidated release can pass or a valid release can be blocked.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for `@zuke/gh` in `deno.json`, `deno.lock` or import statements and note the version.
- Check whether any `githubWorkflow(...)` gate points at a workflow repository where people outside the releasing team hold workflow_dispatch permission.

## Fix

- `@zuke/gh` (Zuke): move to `1.10.0` or later

## Timeline

- 2026-10-30T16:31:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119289

## From the sources

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.10.0, the @zuke/gh githubWorkflow(...) gate correlates a dispatched workflow run using only a display-title marker that is visible in the workflow run list and can be copied by another dispatcher. In configurations where the external workflow repository grants workflow_dispatch permission to a party not equally trusted by the releasing repository, an attacker can dispatch a run with the marker and cause the gate to adopt its conclusion without verifying the event, ref, or creation window. A passing substituted run can authorize an unvalidated release, while a failed or cancelled run can block a valid release, and the persisted adopted run ID preserves the substitution across build resume. This issue is fixed in version 1.10.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_